IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Search Filtering with SearchExInputDTO

    Posted 02/04/21 07:29 AM
    Hi all,

    I need to use SearchExREST API to make search for specific datatable column. For example,

    I have a datatable which contains 2 columns. Datatable's api name is "indicator_table". API names of columns are indicator_source, indicator_description.
    My main need that when i post a search via API, i want it to searches my keyword in just specific datatable column(indicator_description).

    Is it possible?



    ------------------------------
    Burak Karaduman
    ------------------------------


  • 2.  RE: Search Filtering with SearchExInputDTO

    Posted 02/05/21 01:55 PM
    Here is an example:

    curl -k 'https://staging2.internal.resilientsystems.com/rest/search_ex' --data-raw '{"query": "lorem","org_id":230,"filters":{"incident":[{"conditions":[]}],"bentesttable":[{"conditions":[{"method": "equals", "field_name": "bentestcolumnfordatatable", "value": "lorem"}]}]},"types":["datatable"]}'


    This searches where the datatable column bentesttable.bentestcolumnfordatatable is equal to lorem. Notice that the query term must go in the conditions as well as the query part.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Search Filtering with SearchExInputDTO

    Posted 02/05/21 02:02 PM
    Hello Ben,

    It will be very helpful for me. Thanks for your helps.

    ------------------------------
    Burak Karaduman
    ------------------------------